WisePIFinder: Efficient and Accurate Detection of Persistent and Infrequent Flows
Zengxie Ma, Yao Xin, Ying Chen, Zhuochen Fan, Tong Li, Ning Hu, Qing Liao, Yi Min Zhao, Feng Zhang · 2025
In large-scale data stream analytics, accurate identification of Persistent and Infrequent (PI) flows is of great significance for monitoring and protecting against network attacks such as Advanced Persistent Threats (APT). However, existing research focuses mainly on detecting frequent flows or persistent flows, with insufficient studies on the characterization and detection methods for PI flows. Based on the analysis of sufficient APT flows, we propose a method that combines global and local features to effectively characterize PI flows. Further, we propose a novel sketch algorithm called WisePIFinder, which aims to detect PI flows more accurately and efficiently in realtime. The key idea is to continuously filter out non-PI flows while detecting flow persistence, to achieve accurate statistics on PI flows. Experimental results show that WisePIFinder improves the F1 Score by at least 20 % and insertion throughput by at least 60 % compared to the state-of-the-art solution for detecting PI flows. All related codes have been open-sourced on GitHub.